Bug 2123477 - NSS performs unnecessary attribute calls/integrity checks when listing database entries [rhel-9.3.0]
Summary: NSS performs unnecessary attribute calls/integrity checks when listing databa...
Keywords:
Status: ON_QA
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: nss
Version: 9.0
Hardware: Unspecified
OS: Unspecified
low
unspecified
Target Milestone: rc
: ---
Assignee: Bob Relyea
QA Contact: Alexander Sosedkin
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-09-01 18:44 UTC by Hubert Kario
Modified: 2023-08-14 18:15 UTC (History)
1 user (show)

Fixed In Version: nss-3.90.0-3.el9_2
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Function callgraph (157.46 KB, image/png)
2022-09-01 18:44 UTC, Hubert Kario 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Mozilla Foundation 1788739 0 -- NEW Unnecessary integrity checks caused by GOVERNMENT_TRUST attribute 2022-09-01 18:52:25 UTC
Red Hat Issue Tracker CRYPTO-8201 0 None None None 2022-09-01 18:57:43 UTC
Red Hat Issue Tracker RHELPLAN-133056 0 None None None 2022-09-01 18:57:48 UTC

Description Hubert Kario 2022-09-01 18:44:13 UTC 
Created attachment 1909059 [details]
Function callgraph

Description of problem:
When certutil -K is used to list a database with a lot of keys, it takes significant amount of time (1.5-2s on 2.6GHz Skylake for db with 100 entries).

From profiling it looks like it is caused by querying attributes and calculating PBKDF2 for them. GOVERNMENT_TRUST looks like the most likely culprit.

Version-Release number of selected component (if applicable):
nss-3.79.0-13.el9_0.x86_64

How reproducible:
always

Steps to Reproduce:
1. create DBM database on RHEL-8, convert it to SQL, move to RHEL-9
2. valgrind --tool=callgrind certutil  -K -d sql:nssdb -f nssdb/passwd

Actual results:
sftkdb_VerifyAttribute.constprop.0 called over 200 times

Expected results:
fewer calls to integrity check functions

Additional info:
Note You need to log in before you can comment on or make changes to this bug.